PortSwigger Web Security Academy
Learn each web flaw, then exploit it in a hands-on lab
The Web Security Academy is free web security training from PortSwigger, the makers of Burp Suite. Each topic explains a type of flaw in text, sometimes with video, and then gives you interactive labs. In a lab you attack a realistic web app until you solve it.
Free · Browser · Intermediate
About PortSwigger Web Security Academy
It covers 31 topics, including SQL injection, cross-site scripting, CSRF, access control, authentication, JWT attacks, GraphQL and race conditions. It suits developers, bug bounty hunters and future pentesters, and the labs range from simple to very hard.
Everything is free. You create an account to track your progress. Some labs need tools, and the free Burp Suite Community Edition is enough for many of them.
On Breakpoint since 23 Oct 2026.